nixamp 0.8.0 → 0.9.4

package/dist/library.js

@@ -0,0 +1,167 @@
+/**
+ * Where the media is.
+ *
+ * A server that is not told serves the directory it was started in, and a
+ * daemon restarted from a home directory served the home directory: every
+ * key, session and download on the machine, listed in a public directory
+ * under a link anybody could be handed. That is not a default anyone chose,
+ * so it is not a default any more.
+ *
+ * The library is a setting. It is asked for once -- at sign-in, or the first
+ * time the daemon is started without being told -- and kept beside the keys,
+ * so `nixamp daemon start` on its own means the same folder every time. And
+ * some folders are refused however they are asked for: the whole filesystem,
+ * the home directory, anything above it, and the hidden folders where keys
+ * and sessions live.
+ */
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { stateDir } from "./daemon.js";
+export function configPath() {
+    return join(stateDir(), "config.json");
+}
+export function readConfig() {
+    try {
+        const parsed = JSON.parse(readFileSync(configPath(), "utf8"));
+        if (typeof parsed !== "object" || parsed === null)
+            return {};
+        const record = parsed;
+        return { ...(typeof record["library"] === "string" ? { library: record["library"] } : {}) };
+    }
+    catch {
+        return {};
+    }
+}
+export function writeConfig(patch) {
+    const next = { ...readConfig(), ...patch };
+    mkdirSync(stateDir(), { recursive: true });
+    writeFileSync(configPath(), `${JSON.stringify(next, null, 2)}\n`);
+}
+/** The saved library, or "" when nobody has said yet. */
+export function readLibrary() {
+    return readConfig().library ?? "";
+}
+export function writeLibrary(path) {
+    writeConfig({ library: resolve(path) });
+}
+/**
+ * Why a folder must not be served, or "" when it may be.
+ *
+ * Judged on the resolved path, so `~/..` and `/home/me/./` do not slip past.
+ * A hidden folder inside home is refused because that is where `.ssh`,
+ * `.config` and nixamp's own keys are; a hidden folder elsewhere is somebody's
+ * deliberate choice.
+ */
+export function forbiddenLibrary(path, home = homedir()) {
+    const full = resolve(path);
+    const house = resolve(home);
+    if (full === "/" || /^[A-Za-z]:\\?$/.test(full))
+        return "the whole filesystem";
+    if (full === house)
+        return "your whole home directory";
+    if (house.startsWith(`${full}/`))
+        return "a folder above your home directory";
+    if (full.startsWith(`${house}/`)) {
+        // Any dotted segment on the way, not only the last: ~/.local/state is
+        // where nixamp's own keys are, and its basename says nothing.
+        const hidden = full.slice(house.length + 1).split("/").find((segment) => segment.startsWith("."));
+        if (hidden)
+            return `a hidden folder (${hidden}), which is where keys and sessions live`;
+    }
+    return "";
+}
+/** Folders a person is likely to mean, in the order they are likely to mean them. */
+export function suggestedLibraries(home = homedir()) {
+    return ["Music", "Videos", "Movies", "Downloads"]
+        .map((name) => join(home, name))
+        .filter((path) => {
+        try {
+            return statSync(path).isDirectory();
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/** One line from the terminal. Split out so the question can be tested. */
+export async function askLine(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        return (await rl.question(question)).trim();
+    }
+    finally {
+        rl.close();
+    }
+}
+/**
+ * Ask where the media is, refusing the answers that must be refused, and
+ * keep the answer. Empty when the person gave up or gave nothing usable
+ * three times.
+ */
+export async function askLibrary(ask = askLine, home = homedir(), say = (line) => console.log(line)) {
+    const suggestions = suggestedLibraries(home);
+    say("Where is your media? nixamp serves one folder and nothing outside it.");
+    for (const path of suggestions)
+        say(`  ${path}`);
+    const fallback = suggestions[0] ?? "";
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+        const typed = await ask(fallback ? `Folder [${fallback}]: ` : "Folder: ");
+        const chosen = (typed || fallback).replace(/^~(?=$|\/)/, home);
+        if (!chosen)
+            continue;
+        const full = resolve(chosen);
+        const why = forbiddenLibrary(full, home);
+        if (why) {
+            say(`  nixamp will not serve ${why}. Pick a folder with your media in it.`);
+            continue;
+        }
+        if (!existsSync(full) || !statSync(full).isDirectory()) {
+            say(`  ${full} is not a folder here.`);
+            continue;
+        }
+        writeLibrary(full);
+        say(`  Serving ${full}. Change it any time with \`nixamp library <folder>\`.`);
+        return full;
+    }
+    return "";
+}
+/**
+ * The library to use: the saved one, or -- when there is somebody to ask --
+ * the one they name now. "" when there is neither.
+ */
+export async function chooseLibrary(interactive, ask) {
+    const saved = readLibrary();
+    if (saved)
+        return saved;
+    if (!interactive)
+        return "";
+    return askLibrary(ask);
+}
+/** `nixamp library [folder]`: say where the media is, or set it. */
+export async function libraryCommand(argv) {
+    const [given] = argv;
+    if (!given) {
+        const saved = readLibrary();
+        if (!saved) {
+            console.log("nixamp: no library set. `nixamp library ~/Music` sets it, and `nixamp daemon start` serves it.");
+            return 1;
+        }
+        console.log(saved);
+        return 0;
+    }
+    const full = resolve(given.replace(/^~(?=$|\/)/, homedir()));
+    const why = forbiddenLibrary(full);
+    if (why) {
+        console.error(`nixamp: will not serve ${why}. Pick a folder with your media in it.`);
+        return 64;
+    }
+    if (!existsSync(full) || !statSync(full).isDirectory()) {
+        console.error(`nixamp: ${full} is not a folder here.`);
+        return 66;
+    }
+    writeLibrary(full);
+    console.log(`nixamp will serve ${full}. Start it with \`nixamp daemon start\`.`);
+    return 0;
+}

package/dist/main.js

@@ -53,6 +53,8 @@ const HELP = `nixamp — it really whips the terminal's ass.
   nixamp login [--with github]  sign in to nixamp.com, in a browser or here
   nixamp logout / whoami        forget it, or check it
   nixamp token create|list|revoke  tokens for a machine that cannot sign in
+  nixamp dns [set|rm]           names under your handle, for your servers
+  nixamp library [folder]       where the media is; the daemon serves this and nothing outside it
   nixamp server list|add|remove  the machines you run, kept against your account
   nixamp opendir list|add|remove  folders found on the web, published for everyone
   nixamp update [version]        re-run the installer, keeping your choices
@@ -164,6 +166,18 @@ NIXAMP_TOKEN in the environment is a signed-in nixamp with no login at all.
 A token is shown once because the server keeps only its hash. Put it in the
 environment as NIXAMP_TOKEN, or keep it here with \`nixamp login --token\`.
 Signing out does not touch it: that is what it is for.
+`,
+    dns: `nixamp dns — names under your handle, for your servers.
+
+  nixamp dns                     every name on your account, and where it points
+  nixamp dns set NAME            NAME.<handle>.nixamp.com, pointed at this machine
+  nixamp dns set NAME --a IP --aaaa IP   pointed somewhere you name; "off" clears one
+  nixamp dns set NAME --ttl N    how long resolvers may keep it (seconds)
+  nixamp dns rm NAME             take the name away
+
+The DNS keys stay on nixamp.com. A signed-in \`nixamp serve\` names itself
+this way on start and picks up the handle's certificate, so a server is
+https://NAME.<handle>.nixamp.com with nothing typed here.
 `,
     daemon: `nixamp daemon — a nixamp that outlives the terminal that started it.
 
@@ -221,9 +235,45 @@ async function runDaemon(argv) {
     const d = await import("./daemon.js");
     const [action = "status", ...rest] = argv;
     const entry = fileURLToPath(new URL("./main.js", import.meta.url));
+    // The daemon has to know where the media is. Told a folder, that folder is
+    // kept as the library so the next start needs no telling; told nothing, the
+    // saved library is used, or asked for when there is somebody to ask.
+    const withLibrary = async (args) => {
+        const { forbiddenLibrary, chooseLibrary, writeLibrary } = await import("./library.js");
+        const { parseServeArgs } = await import("./server.js");
+        const { isRemote } = await import("./sources.js");
+        let given = "";
+        try {
+            given = parseServeArgs(args).root;
+        }
+        catch {
+            // A bad flag is the daemon's to report, in its own words.
+            return args;
+        }
+        if (given) {
+            if (!isRemote(given)) {
+                const why = forbiddenLibrary(given);
+                if (why) {
+                    console.error(`nixamp: will not serve ${why}. Pick a folder with your media in it.`);
+                    return null;
+                }
+                writeLibrary(given);
+            }
+            return args;
+        }
+        const library = await chooseLibrary(process.stdin.isTTY === true);
+        if (!library) {
+            console.error("nixamp: which folder? `nixamp library ~/Music` once, then `nixamp daemon start`.");
+            return null;
+        }
+        return [library, ...args];
+    };
     if (action === "start") {
+        const args = await withLibrary(rest);
+        if (args === null)
+            return 64;
         try {
-            const state = await d.start(rest, entry);
+            const state = await d.start(args, entry);
             for (const line of d.daemonLines(state))
                 console.log(line);
             return 0;
@@ -239,8 +289,13 @@ async function runDaemon(argv) {
         return 0;
     }
     if (action === "restart") {
+        // With no arguments the flags it was started with are replayed, library
+        // included; with arguments, the library rule applies as for start.
+        const args = rest.length === 0 ? rest : await withLibrary(rest);
+        if (args === null)
+            return 64;
         try {
-            const state = await d.restart(rest, entry);
+            const state = await d.restart(args, entry);
             for (const line of d.daemonLines(state))
                 console.log(line);
             return 0;
@@ -298,7 +353,14 @@ export async function main() {
     }
     if (first === "serve") {
         const { serve } = await import("./server.js");
-        await serve(rest, version());
+        try {
+            await serve(rest, version());
+        }
+        catch (error) {
+            // A refusal is a sentence, not a stack trace.
+            console.error(error.message);
+            process.exitCode = 64;
+        }
         return;
     }
     if (first === "daemon") {
@@ -313,6 +375,14 @@ export async function main() {
     if (first === "login" || first === "signup") {
         const { login } = await import("./session.js");
         process.exitCode = await login(first === "signup" ? [...rest, "--signup"] : rest);
+        // Signed in is the moment a machine is about to be a server, so it is
+        // the moment to ask where the media is -- once, kept beside the keys.
+        if (process.exitCode === 0 && process.stdin.isTTY) {
+            const { chooseLibrary } = await import("./library.js");
+            const library = await chooseLibrary(true);
+            if (library)
+                console.log("  Start serving it with `nixamp daemon start`.");
+        }
         return;
     }
     if (first === "opendir" || first === "opendirs") {
@@ -330,6 +400,16 @@ export async function main() {
         process.exitCode = await tokens(rest);
         return;
     }
+    if (first === "dns") {
+        const { dns } = await import("./session.js");
+        process.exitCode = await dns(rest);
+        return;
+    }
+    if (first === "library") {
+        const { libraryCommand } = await import("./library.js");
+        process.exitCode = await libraryCommand(rest);
+        return;
+    }
     if (first === "logout" || first === "whoami") {
         const session = await import("./session.js");
         process.exitCode = first === "logout" ? session.logout() : await session.whoami();
@@ -346,8 +426,16 @@ export async function main() {
     }
     // resolve() would turn https://host/x into /cwd/https:/host/x, so a URL is
     // left exactly as it was typed.
-    const asked = first ?? ".";
+    // The saved library before the current directory, and never a folder the
+    // server would refuse: `d` hands this same folder to a daemon.
+    const { forbiddenLibrary, readLibrary } = await import("./library.js");
+    const asked = first ?? (readLibrary() || ".");
     const target = isRemote(asked) ? asked : resolve(asked);
+    const why = isRemote(target) ? "" : forbiddenLibrary(target);
+    if (why) {
+        console.error(`nixamp: will not play ${why}. Pick a folder with your media in it, or set one: nixamp library ~/Music`);
+        process.exit(64);
+    }
     const tools = detectTools();
     // The noise it makes when it wakes up. Started before the library is walked
     // so it plays over the wait rather than after it, and never awaited: a

package/dist/names.d.ts

@@ -0,0 +1,66 @@
+/**
+ * An account's names: the servers it runs, each with a hostname under its handle.
+ *
+ * `server2.chovy.nixamp.com` used to be a record somebody typed into the
+ * registrar by hand, which is why the second machine came up as a bare IP
+ * over http. A name is now a row against the account, mirrored into the zone
+ * as an A and an AAAA record, and the account may make, change and drop as
+ * many as it reasonably needs without anybody holding a registrar key.
+ *
+ * The database row is the truth and the zone follows it: the zone is written
+ * first, so a registrar that refuses is an error to the caller and nothing is
+ * stored, rather than a row that claims a name the world cannot resolve.
+ */
+import type { Queryable } from "./follows.ts";
+import { type DnsZone } from "./dns.ts";
+export interface NameRecord {
+    label: string;
+    host: string;
+    a: string;
+    aaaa: string;
+    ttl: number;
+    createdAt: number;
+    updatedAt: number;
+}
+/** An error with the HTTP status it deserves, so a route can pass it straight on. */
+export declare class NameError extends Error {
+    status: number;
+    constructor(status: number, message: string);
+}
+/**
+ * The label a server may have: two to thirty of [a-z0-9-], not starting or
+ * ending with a hyphen, lowercased for the caller who typed it in capitals.
+ * "" when it is not one, so a route can say so in one sentence.
+ */
+export declare function validLabel(value: unknown): string;
+export declare const MIN_TTL = 600;
+export declare const MAX_TTL = 86400;
+/** Enough for a rack, not enough for a squatter. */
+export declare const DEFAULT_PER_ACCOUNT = 20;
+export declare class Names {
+    private readonly db;
+    private readonly dns;
+    private readonly limits;
+    private ready;
+    constructor(db: Queryable, dns: DnsZone, limits?: {
+        perAccount?: number;
+    });
+    private ensure;
+    private host;
+    private record;
+    list(accountId: string, handle: string): Promise<NameRecord[]>;
+    /** The row for one name, whoever owns it. */
+    private find;
+    /**
+     * Make or change a name. `null` for a family takes that record away,
+     * `undefined` leaves it as it was, so a server that has only ever had an
+     * IPv4 address can be given an IPv6 one without restating the first.
+     */
+    set(accountId: string, handle: string, wanted: unknown, want: {
+        a?: string | null;
+        aaaa?: string | null;
+        ttl?: number;
+    }): Promise<NameRecord>;
+    /** Take a name away. False when it is not this account's to take. */
+    remove(accountId: string, handle: string, wanted: unknown): Promise<boolean>;
+}

package/dist/names.js

@@ -0,0 +1,184 @@
+import { isReserved } from "./handles.js";
+import { isIPv4, isIPv6 } from "./dns.js";
+/** An error with the HTTP status it deserves, so a route can pass it straight on. */
+export class NameError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+/**
+ * Names nobody may give a server, over and above the handles nobody may take:
+ * the mail and discovery names a client resolves on its own, anything an
+ * underscore marks as a protocol record, and anything punycode-shaped.
+ */
+const RESERVED_LABELS = new Set([
+    "www", "mail", "mx", "smtp", "imap", "pop", "ns1", "ns2", "ftp",
+    "_dmarc", "_acme-challenge", "autoconfig", "autodiscover",
+]);
+/**
+ * The label a server may have: two to thirty of [a-z0-9-], not starting or
+ * ending with a hyphen, lowercased for the caller who typed it in capitals.
+ * "" when it is not one, so a route can say so in one sentence.
+ */
+export function validLabel(value) {
+    if (typeof value !== "string")
+        return "";
+    const label = value.trim().toLowerCase();
+    if (!/^[a-z0-9][a-z0-9-]{0,28}[a-z0-9]$/.test(label))
+        return "";
+    if (label.startsWith("_") || label.startsWith("xn--"))
+        return "";
+    if (RESERVED_LABELS.has(label) || isReserved(label))
+        return "";
+    return label;
+}
+const TABLE = "dns_names";
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS ${TABLE} (
+    account_id  TEXT NOT NULL,
+    handle      TEXT NOT NULL,
+    label       TEXT NOT NULL,
+    a           TEXT NOT NULL DEFAULT '',
+    aaaa        TEXT NOT NULL DEFAULT '',
+    ttl         INTEGER NOT NULL DEFAULT 600,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (handle, label)
+  );
+  CREATE INDEX IF NOT EXISTS ${TABLE}_account ON ${TABLE} (account_id);
+`;
+export const MIN_TTL = 600;
+export const MAX_TTL = 86_400;
+/** Enough for a rack, not enough for a squatter. */
+export const DEFAULT_PER_ACCOUNT = 20;
+function when(value) {
+    if (value instanceof Date)
+        return value.getTime();
+    const parsed = new Date(String(value ?? 0)).getTime();
+    return Number.isFinite(parsed) ? parsed : 0;
+}
+export class Names {
+    db;
+    dns;
+    limits;
+    ready = null;
+    constructor(db, dns, limits = {}) {
+        this.db = db;
+        this.dns = dns;
+        this.limits = limits;
+    }
+    async ensure() {
+        this.ready ??= this.db.query(SCHEMA).then(() => undefined);
+        await this.ready;
+    }
+    host(handle, label) {
+        return `${label}.${handle}.${this.dns.zone}`;
+    }
+    record(handle, row) {
+        return {
+            label: row.label,
+            host: this.host(handle, row.label),
+            a: row.a ?? "",
+            aaaa: row.aaaa ?? "",
+            ttl: Number(row.ttl) || MIN_TTL,
+            createdAt: when(row.created_at),
+            updatedAt: when(row.updated_at),
+        };
+    }
+    async list(accountId, handle) {
+        await this.ensure();
+        const { rows } = await this.db.query(`SELECT account_id, handle, label, a, aaaa, ttl, created_at, updated_at
+       FROM ${TABLE} WHERE account_id = $1 AND handle = $2 ORDER BY created_at`, [accountId, handle]);
+        return rows.map((row) => this.record(handle, row));
+    }
+    /** The row for one name, whoever owns it. */
+    async find(handle, label) {
+        const { rows } = await this.db.query(`SELECT account_id, handle, label, a, aaaa, ttl, created_at, updated_at
+       FROM ${TABLE} WHERE handle = $1 AND label = $2`, [handle, label]);
+        return rows[0] ?? null;
+    }
+    /**
+     * Make or change a name. `null` for a family takes that record away,
+     * `undefined` leaves it as it was, so a server that has only ever had an
+     * IPv4 address can be given an IPv6 one without restating the first.
+     */
+    async set(accountId, handle, wanted, want) {
+        const label = validLabel(wanted);
+        if (label === "")
+            throw new NameError(400, "that is not a name a server can have");
+        if (want.a !== undefined && want.a !== null && !isIPv4(want.a)) {
+            throw new NameError(400, "that is not an IPv4 address");
+        }
+        if (want.aaaa !== undefined && want.aaaa !== null && !isIPv6(want.aaaa)) {
+            throw new NameError(400, "that is not an IPv6 address");
+        }
+        await this.ensure();
+        const existing = await this.find(handle, label);
+        if (existing !== null && existing.account_id !== accountId) {
+            throw new NameError(409, "that name belongs to somebody else");
+        }
+        if (existing === null) {
+            const { rows } = await this.db.query(`SELECT count(*)::int AS n FROM ${TABLE} WHERE account_id = $1`, [accountId]);
+            const have = Number(rows[0]?.n ?? 0);
+            const limit = this.limits.perAccount ?? DEFAULT_PER_ACCOUNT;
+            if (have >= limit)
+                throw new NameError(422, `an account may have ${limit} names, and this one has ${have}`);
+        }
+        // What the name will point at once this is done.
+        const a = want.a === undefined ? (existing?.a ?? "") : (want.a ?? "");
+        const aaaa = want.aaaa === undefined ? (existing?.aaaa ?? "") : (want.aaaa ?? "");
+        if (a === "" && aaaa === "")
+            throw new NameError(400, "give an address");
+        const ttl = Math.min(MAX_TTL, Math.max(MIN_TTL, Math.floor(want.ttl ?? existing?.ttl ?? MIN_TTL)));
+        // The zone first. A registrar that says no is the caller's problem to hear
+        // about now, not a row that claims a name the world cannot resolve.
+        const host = this.host(handle, label);
+        try {
+            if (a !== "")
+                await this.dns.set(host, "A", a, ttl);
+            else if (existing !== null && existing.a !== "")
+                await this.dns.remove(host, "A");
+            if (aaaa !== "")
+                await this.dns.set(host, "AAAA", aaaa, ttl);
+            else if (existing !== null && existing.aaaa !== "")
+                await this.dns.remove(host, "AAAA");
+        }
+        catch (error) {
+            throw new NameError(502, `the zone did not take that record: ${error.message}`);
+        }
+        const { rows } = await this.db.query(`INSERT INTO ${TABLE} (account_id, handle, label, a, aaaa, ttl)
+       VALUES ($1, $2, $3, $4, $5, $6)
+       ON CONFLICT (handle, label) DO UPDATE
+         SET a = EXCLUDED.a, aaaa = EXCLUDED.aaaa, ttl = EXCLUDED.ttl, updated_at = now()
+       RETURNING account_id, handle, label, a, aaaa, ttl, created_at, updated_at`, [accountId, handle, label, a, aaaa, ttl]);
+        const row = rows[0];
+        return this.record(handle, row ?? {
+            account_id: accountId, handle, label, a, aaaa, ttl,
+            created_at: existing?.created_at ?? new Date(), updated_at: new Date(),
+        });
+    }
+    /** Take a name away. False when it is not this account's to take. */
+    async remove(accountId, handle, wanted) {
+        const label = validLabel(wanted);
+        if (label === "")
+            return false;
+        await this.ensure();
+        const existing = await this.find(handle, label);
+        if (existing === null || existing.account_id !== accountId)
+            return false;
+        const host = this.host(handle, label);
+        try {
+            await this.dns.remove(host, "A");
+            await this.dns.remove(host, "AAAA");
+        }
+        catch (error) {
+            throw new NameError(502, `the zone did not let go of that record: ${error.message}`);
+        }
+        await this.db.query(`DELETE FROM ${TABLE} WHERE account_id = $1 AND handle = $2 AND label = $3`, [
+            accountId, handle, label,
+        ]);
+        return true;
+    }
+}

package/dist/naming.d.ts

@@ -0,0 +1,57 @@
+export interface Named {
+    host: string;
+    a: string;
+    aaaa: string;
+}
+export interface CertFiles {
+    cert: string;
+    key: string;
+    expiresAt: number;
+    /** The name on the certificate, e.g. `*.chovy.nixamp.com`. */
+    host: string;
+}
+/**
+ * Claim, or refresh, this machine's name.
+ *
+ * "auto" for both families: the site records whichever addresses this request
+ * arrived from, which is the only honest answer to "what is my public
+ * address" from behind a router. Null when refused or unreachable, and the
+ * reason is said rather than thrown: a server without a name still serves.
+ */
+export declare function claimName(site: string, token: string, label: string, say: (line: string) => void, fetcher?: typeof fetch): Promise<Named | null>;
+/**
+ * The handle's certificate.
+ *
+ * The first one is issued while we wait: a wildcard by DNS challenge takes a
+ * couple of minutes, which is said once so the pause reads as work rather
+ * than a hang. After that it is a cached answer on the site's side.
+ */
+export declare function fetchCert(site: string, token: string, opts: {
+    waitMs?: number;
+    everyMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+    fetcher?: typeof fetch;
+}, say: (line: string) => void): Promise<CertFiles | null>;
+/**
+ * Keep a certificate beside the keys. Private, because the key is what lets
+ * anybody be this server.
+ */
+export declare function writeCertFiles(stateDir: string, files: CertFiles): {
+    cert: string;
+    key: string;
+};
+/**
+ * The certificate from last time, if it is still good for more than a day.
+ * Anything closer to expiry is treated as absent so the next start fetches
+ * a fresh one rather than serving one that lapses overnight.
+ */
+export declare function readCertFiles(stateDir: string, host: string): {
+    cert: string;
+    key: string;
+    expiresAt: number;
+} | null;
+/**
+ * What this machine calls itself in DNS: the name it was given, else the
+ * first label of its hostname, made safe for a subdomain.
+ */
+export declare function labelFor(name: string, hostname: string): string;